CVE-2025-36611: 
Dell Security Management Server vulnerability analysis and mitigation

CVE-2025-36611 is an Improper Link Resolution Before File Access ('Link Following') vulnerability (CWE-59) affecting Dell Encryption and Dell Security Management Server. A local low-privileged user can exploit this flaw to escalate privileges on affected systems. Affected versions include Dell Encryption prior to 11.11.0.1 and Dell Security Management Server prior to 11.11.0.2. The vulnerability was published on July 30, 2025, with a CVSS v3.1 base score of 7.8 (High) (Dell Advisory).

The vulnerability is classified as CWE-59 (Improper Link Resolution Before File Access / 'Link Following'), commonly exploited via symlink attacks (CAPEC-132). An attacker with local, low-privileged access can create a malicious symbolic link that causes the affected Dell software to access or operate on unintended files with elevated permissions, enabling privilege escalation. No user interaction is required, and attack complexity is low, making this straightforward to exploit for any local user with minimal privileges (Dell Advisory).

Successful exploitation allows a local low-privileged attacker to escalate privileges, resulting in high confidentiality, integrity, and availability impacts on the affected system. An attacker could gain elevated access to sensitive encrypted data managed by Dell Encryption or the Security Management Server, potentially compromising the entire host. This could facilitate further lateral movement within an enterprise environment where these products are deployed (Dell Advisory).

There is currently no public proof-of-concept exploit and no evidence of in-the-wild exploitation for CVE-2025-36611. The EPSS score is approximately 0.009% (0.000090), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, though CISA referenced it in their weekly vulnerability bulletin for the week of July 28, 2025 (Dell Advisory, CISA Bulletin).

1. Reconnaissance: Identify a target system running Dell Encryption (< 11.11.0.1) or Dell Security Management Server (< 11.11.0.2) with local user access.
2. Identify vulnerable file operations: Determine which files or directories the Dell software accesses with elevated privileges during normal operation (e.g., during service startup, file processing, or configuration reads).
3. Create a malicious symlink: As a low-privileged local user, create a symbolic link at a path the vulnerable Dell process is expected to access, pointing it to a sensitive system file or directory (e.g., a privileged configuration file or executable).
4. Trigger the vulnerable operation: Initiate the file access operation in the Dell software (e.g., by restarting a service or triggering a scheduled task) so that the software follows the symlink and operates on the attacker-controlled target path with elevated privileges.
5. Achieve privilege escalation: Leverage the elevated file access to write malicious content, overwrite privileged files, or read sensitive data, resulting in full privilege escalation on the host (Dell Advisory).

• File System: Unexpected symbolic links in directories accessed by Dell Encryption or Dell Security Management Server services; newly created symlinks pointing to sensitive system files or directories from low-privileged user accounts.
• Logs: System or application logs showing Dell service processes accessing unusual file paths not consistent with normal operation; permission errors or access anomalies in Dell Encryption or Security Management Server logs.
• Process: Dell service processes (e.g., related to encryption or security management) spawning unexpected child processes or accessing files outside their normal operational scope.
• Audit Events: Windows Security Event Log entries (e.g., Event ID 4663 - object access) showing Dell service accounts accessing files or directories owned by or intended for privileged users, triggered by low-privileged accounts.

Dell has released patched versions addressing this vulnerability: upgrade Dell Encryption to version 11.11.0.1 or later, and Dell Security Management Server to version 11.11.0.2 or later. As interim mitigations, restrict local system access to trusted users only, apply the principle of least privilege to minimize accounts with local access, and monitor for suspicious symlink creation or anomalous file access patterns. Patch details are available in Dell Security Advisory DSA-2025-292 (Dell Advisory).

The vulnerability was noted in the CISA weekly vulnerability bulletin for the week of July 28, 2025, and picked up by security aggregators including Red Packet Security and CIRCL's vulnerability lookup service. No significant independent researcher commentary or notable media coverage has been identified beyond standard vulnerability tracking and aggregation (CISA Bulletin).